/*

  Fuzz conditional ace decoding and encoding

  Copyright (C) Catalyst IT 2023

  This program is free software; you can redistribute it and/or modify

  it under the terms of the GNU General Public License as published by

  the Free Software Foundation; either version 3 of the License, or

  (at your option) any later version.

  This program is distributed in the hope that it will be useful,

  but WITHOUT ANY WARRANTY; without even the implied warranty of

  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

  GNU General Public License for more details.

  You should have received a copy of the GNU General Public License

  along with this program.  If not, see <http://www.gnu.org/licenses/>.

*/

#include "replace.h"

#include "libcli/security/security.h"

#include "lib/util/attr.h"

#include "librpc/gen_ndr/ndr_security.h"

#include "libcli/security/conditional_ace.h"

#include "librpc/gen_ndr/conditional_ace.h"

#include "fuzzing/fuzzing.h"

#define MAX_LENGTH (1024 * 1024 - 1)

int LLVMFuzzerInitialize(int *argc, char ***argv)

{

  return 0;

}

int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)

{

  TALLOC_CTX *mem_ctx = NULL;

  bool ok;

  struct ace_condition_script *s1 = NULL;

  struct ace_condition_script *s2 = NULL;

  const char *message = NULL;

  size_t message_offset;

  const char *sddl = NULL;

  DATA_BLOB e1, e2;

  size_t length;

  if (len > MAX_LENGTH) {

    return 0;

  }

  /*

   * In this one we are treating the input data as an ACE blob,

   * and decoding it into the structure and thence SDDL.

   *

   * This doesn't run the conditional ACE, for which we would

   * need a security token.

   */

  e1.data = discard_const(input);

  e1.length = len;

  mem_ctx = talloc_new(NULL);

  s1 = parse_conditional_ace(mem_ctx, e1);

  if (s1 == NULL) {

    /* no worries, it was nonsense */

    TALLOC_FREE(mem_ctx);

    return 0;

  }

  /* back to blob form */

  ok = conditional_ace_encode_binary(mem_ctx, s1, &e2);

  if (! ok) {

    if (e1.length == CONDITIONAL_ACE_MAX_LENGTH) {

      /*

       * This is an edge case where the encoder and

       * decoder treat the boundary slightly

       * differently, and the encoder refuses to

       * encode to the maximum length. This is not

       * an issue in the real world.

       */

      TALLOC_FREE(mem_ctx);

      return 0;

    }

    abort();

  }

  if (data_blob_cmp(&e1, &e2) != 0) {

    abort();

  }

  sddl = sddl_from_conditional_ace(mem_ctx, s1);

  if (sddl == NULL) {

    /*

     * we can't call this a failure, because the blob

     * could easily have nonsensical programs that the

     * SDDL decompiler is unwilling to countenance. For

     * example, it could have an operator that requires

     * arguments as the first token, when of course the

     * arguments need to come first.

     */

    TALLOC_FREE(mem_ctx);

    return 0;

  }

  s2 = ace_conditions_compile_sddl(mem_ctx,

           ACE_CONDITION_FLAG_ALLOW_DEVICE,

           sddl,

           &message,

           &message_offset,

           &length);

  if (s2 == NULL) {

    /*

     * We also don't complain when the SDDL decompiler

     * produces an uncompilable program, because the

     * decompiler is meant to be a display tool, not a

     * verifier in itself.

     */

    TALLOC_FREE(mem_ctx);

    return 0;

  }

  ok = conditional_ace_encode_binary(mem_ctx, s2, &e2);

  if (! ok) {

    if (len < CONDITIONAL_ACE_MAX_LENGTH / 4) {

      /*

       * long invalid ACEs can easily result in SDDL that

       * would compile to an over-long ACE, which fail

       * accordingly.

       *

       * But if the original ACE less than a few thousand

       * bytes, and it has been serialised into SDDL, that

       * SDDL should be parsable.

       */

      abort();

    }

  }

  /*

   * It would be nice here to go:

   *

   * if (data_blob_cmp(&e1, &e2) != 0) {

   *       abort();

   * }

   *

   * but that isn't really fair. The decompilation into SDDL

   * does not make thorough sanity checks because that is not

   * its job -- it is just trying to depict what is there -- and

   * there are many ambiguous decompilations.

   *

   * For example, a blob with a single literal integer token,

   * say 42, can only really be shown in the SDDL syntax as

   * "(42)", but when the compiler reads that it knows that a

   * literal number is invalid except in a RHS argument, so it

   * assumes "42" is a local attribute name.

   *

   * Even if the decompiler was a perfect verifier, a round trip

   * through SDDL could not be guaranteed because, for example,

   * an 8 bit integer can only be displayed in SDDL in the form

   * that compiles to a 64 bit integer.

   */

  TALLOC_FREE(mem_ctx);

  return 0;

}